337785 - Importing CA chain: Can't import new intermediate if root is already present

Status: NEW

(Core :: Security: PSM, defect, P3)

Description

[Kai Engert (:KaiE:)]

Given this hierarchy of CA certs:
  Root CA Cert
  |
  |_ Intermediate cert A
  |
  |_ Intermediate cert B

Go to a web page that delivers:
  Root CA Cert
  |
  |_ Intermediate cert A

as content-type application/x-x509-ca-cert.

Import that chain.
Go to cert manager and you'll find that both certs have been imported.

Now go to a web page that delivers:
  Root CA Cert
  |
  |_ Intermediate cert B
as content-type application/x-x509-ca-cert.

Actual result:
  Nothing gets imported in addition.
  You get a message saying "cert already exists".

Expected behaviour:
  Intermediate cert B should get imported

Comment 1

[Kai Engert (:KaiE:)]

Here are two example chains that can be used to reproduce the bug:

http://kuix.de/misc/bug337785/chain1.php
http://kuix.de/misc/bug337785/chain2.php

Comment 2

[Kai Engert (:KaiE:)]

reassign bug owner.
mass-update-kaie-20120918

Comment 3

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

I think this will be fixed by bug 1257403, although there is still the issue of the already present root that may or may not prevent this working as expected.

Comment 4

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

Backlog => P3